approval attestation request digest

Trap: validating an attestation against current live state looks sufficient, but the workflow may consume older event payload inputs after the issue changes. Fix: SHA-256 hash exact {title, body, dryRun} event state, require EXPECTED_REQUEST_DIGEST at every executable and exported validation boundary, and compare it with live state before minting or consuming proofs. Exclude transient workflow labels; any title, body, or dry-run change requires renewed approval.